ceph: avoid a use-after-free in ceph_destroy_options() (8aaff151) · Commits · 戴 / test

fs/ceph/super.c

+11 −5

Original line number	Diff line number	Diff line
		@@ -602,6 +602,8 @@ static int extra_mon_dispatch(struct ceph_client client, struct ceph_msg msg)

		/*
		* create a new fs client
		*
		* Success or not, this function consumes @fsopt and @opt.
		*/
		static struct ceph_fs_client create_fs_client(struct ceph_mount_options fsopt,
		struct ceph_options *opt)
		@@ -609,17 +611,20 @@ static struct ceph_fs_client create_fs_client(struct ceph_mount_options fsopt,
		struct ceph_fs_client *fsc;
		int page_count;
		size_t size;
		int err = -ENOMEM;
		int err;

		fsc = kzalloc(sizeof(*fsc), GFP_KERNEL);
		if (!fsc)
		return ERR_PTR(-ENOMEM);
		if (!fsc) {
		err = -ENOMEM;
		goto fail;
		}

		fsc->client = ceph_create_client(opt, fsc);
		if (IS_ERR(fsc->client)) {
		err = PTR_ERR(fsc->client);
		goto fail;
		}
		opt = NULL; /* fsc->client now owns this */

		fsc->client->extra_mon_dispatch = extra_mon_dispatch;
		fsc->client->osdc.abort_on_full = true;
		@@ -677,6 +682,9 @@ fail_client:
		ceph_destroy_client(fsc->client);
		fail:
		kfree(fsc);
		if (opt)
		ceph_destroy_options(opt);
		destroy_mount_options(fsopt);
		return ERR_PTR(err);
		}

		@@ -1042,8 +1050,6 @@ static struct dentry ceph_mount(struct file_system_type fs_type,
		fsc = create_fs_client(fsopt, opt);
		if (IS_ERR(fsc)) {
		res = ERR_CAST(fsc);
		destroy_mount_options(fsopt);
		ceph_destroy_options(opt);
		goto out_final;
		}